# Vulnerabilities published in 2020 - [CVE-2020-22607](https://insights.sbomify.com/CVE-2020-22607/): Cross-site scripting in limesurvey:limesurvey (medium 6.1) - [CVE-2020-2260](https://insights.sbomify.com/CVE-2020-2260/): Missing permission check in Perfecto Plugin (medium 4.3) - [CVE-2020-22597](https://insights.sbomify.com/CVE-2020-22597/): Code injection in jerryscript:jerryscript (critical 9.8) - [CVE-2020-2259](https://insights.sbomify.com/CVE-2020-2259/): Stored XSS vulnerability in computer-queue-plugin Plugin (medium 5.4) - [CVE-2020-2258](https://insights.sbomify.com/CVE-2020-2258/): Incorrect permission check in Health Advisor by CloudBees Plugin (medium 4.3) - [CVE-2020-22570](https://insights.sbomify.com/CVE-2020-22570/): Denial of service in memcached:memcached (high 7.5) - [CVE-2020-2257](https://insights.sbomify.com/CVE-2020-2257/): Stored XSS vulnerability in Validating String Parameter Plugin (medium 5.4) - [CVE-2020-2256](https://insights.sbomify.com/CVE-2020-2256/): Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name (medium 5.4) - [CVE-2020-22552](https://insights.sbomify.com/CVE-2020-22552/): Denial of service in snap7 project:snap7 (high 7.5) - [CVE-2020-22550](https://insights.sbomify.com/CVE-2020-22550/): Path traversal in veno file manager project:veno file manager (high 7.5) - [CVE-2020-2255](https://insights.sbomify.com/CVE-2020-2255/): Missing permission check in Blue Ocean Plugin (medium 4.3) - [CVE-2020-22540](https://insights.sbomify.com/CVE-2020-22540/): Cross-site scripting in codologic:codoforum (medium 5.4) - [CVE-2020-2254](https://insights.sbomify.com/CVE-2020-2254/): Path traversal vulnerability in Blue Ocean Plugin (medium 6.5) - [CVE-2020-22539](https://insights.sbomify.com/CVE-2020-22539/): File upload in codologic:codoforum (high 7.2) - [CVE-2020-22535](https://insights.sbomify.com/CVE-2020-22535/): Missing authorization in pbootcms:pbootcms (medium 6.5) - [CVE-2020-22533](https://insights.sbomify.com/CVE-2020-22533/): Cross-site scripting in easycorp:zentao (medium 6.1) - [CVE-2020-2253](https://insights.sbomify.com/CVE-2020-2253/): Missing hostname validation in Email Extension Plugin (medium 4.8) - [CVE-2020-22524](https://insights.sbomify.com/CVE-2020-22524/): Memory corruption in freeimage project:freeimage (medium 6.5) - [CVE-2020-2252](https://insights.sbomify.com/CVE-2020-2252/): Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin (medium 4.8) - [CVE-2020-2251](https://insights.sbomify.com/CVE-2020-2251/): Passwords transmitted in plain text by Jenkins ReadyAPI Functional Testing Plugin (medium 4.3) - [CVE-2020-2250](https://insights.sbomify.com/CVE-2020-2250/): Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin (medium 6.5) - [CVE-2020-2249](https://insights.sbomify.com/CVE-2020-2249/): Credentials stored in plain text by Jenkins tfs Plugin (low 3.3) - [CVE-2020-22481](https://insights.sbomify.com/CVE-2020-22481/): Cross-site scripting in hack:hfish (medium 6.1) - [CVE-2020-2248](https://insights.sbomify.com/CVE-2020-2248/): Reflected XSS vulnerability in Jenkins JSGames Plugin (medium 6.1) - [CVE-2020-22475](https://insights.sbomify.com/CVE-2020-22475/): Missing authorization in tasks:tasks (medium 6.8) - [CVE-2020-22474](https://insights.sbomify.com/CVE-2020-22474/): Path traversal in weberp:weberp (medium 6.5) - [CVE-2020-2247](https://insights.sbomify.com/CVE-2020-2247/): XXE vulnerability in Jenkins Klocwork Analysis Plugin (medium 6.5) - [CVE-2020-2246](https://insights.sbomify.com/CVE-2020-2246/): Stored XSS vulnerability in Jenkins Valgrind Plugin (medium 5.4) - [CVE-2020-22453](https://insights.sbomify.com/CVE-2020-22453/): Cross-site scripting in untis:webuntis (medium 6.1) - [CVE-2020-22452](https://insights.sbomify.com/CVE-2020-22452/): phpmyadmin contains SQL Injection vulnerability (critical 9.8) - [CVE-2020-2245](https://insights.sbomify.com/CVE-2020-2245/): XXE vulnerability in Jenkins Valgrind Plugin (high 7.1) - [CVE-2020-2244](https://insights.sbomify.com/CVE-2020-2244/): XSS vulnerability in Jenkins Build Failure Analyzer Plugin (medium 5.4) - [CVE-2020-2243](https://insights.sbomify.com/CVE-2020-2243/): Stored XSS vulnerability in Jenkins Cadence vManager Plugin (medium 5.4) - [CVE-2020-22429](https://insights.sbomify.com/CVE-2020-22429/): Use after free in redox-os:redox (high 7.8) - [CVE-2020-22428](https://insights.sbomify.com/CVE-2020-22428/): Cross-site scripting in solarwinds:serv-u ftp server (medium 4.8) - [CVE-2020-22427](https://insights.sbomify.com/CVE-2020-22427/): Command injection in nagios:nagios xi (high 7.2) - [CVE-2020-22425](https://insights.sbomify.com/CVE-2020-22425/): SQL injection in centreon:centreon (high 8.8) - [CVE-2020-22421](https://insights.sbomify.com/CVE-2020-22421/): Cross-site scripting in 74cms:74cms (medium 6.1) - [CVE-2020-2242](https://insights.sbomify.com/CVE-2020-2242/): Missing permission checks in Jenkins Database Plugin (medium 6.5) - [CVE-2020-2241](https://insights.sbomify.com/CVE-2020-2241/): CSRF vulnerability in Jenkins Database Plugin (high 8.8) - [CVE-2020-22403](https://insights.sbomify.com/CVE-2020-22403/): Cross-Site Request Forgery in express-cart (high 8.8) - [CVE-2020-22402](https://insights.sbomify.com/CVE-2020-22402/): Cross-site scripting in alinto:sogo web mail (medium 6.1) - [CVE-2020-2240](https://insights.sbomify.com/CVE-2020-2240/): CSRF vulnerability in Jenkins Database Plugin (high 8.8) - [CVE-2020-22394](https://insights.sbomify.com/CVE-2020-22394/): Cross-site scripting in yzmcms:yzmcms (medium 6.1) - [CVE-2020-22392](https://insights.sbomify.com/CVE-2020-22392/): Cross Site Scripting in Subrion CMS (medium 5.4) - [CVE-2020-22390](https://insights.sbomify.com/CVE-2020-22390/): Code injection in akaunting:akaunting (high 8.8) - [CVE-2020-2239](https://insights.sbomify.com/CVE-2020-2239/): Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin (medium 4.3) - [CVE-2020-2238](https://insights.sbomify.com/CVE-2020-2238/): Stored XSS vulnerability in Jenkins Git Parameter Plugin (medium 5.4) - [CVE-2020-2237](https://insights.sbomify.com/CVE-2020-2237/): CSRF vulnerability in Jenkins Flaky Test Handler Plugin (medium 4.3) - [CVE-2020-2236](https://insights.sbomify.com/CVE-2020-2236/): Stored XSS vulnerability in Jenkins Yet Another Build Visualizer Plugin (medium 5.4) - [CVE-2020-22352](https://insights.sbomify.com/CVE-2020-22352/): Null dereference in gpac:gpac (medium 5.5) - [CVE-2020-2235](https://insights.sbomify.com/CVE-2020-2235/): CSRF vulnerability in Jenkins Pipeline Maven Integration Plugin allow capturing credentials (medium 6.5) - [CVE-2020-22345](https://insights.sbomify.com/CVE-2020-22345/): OS Command Injection in Centreon (high 8.8) - [CVE-2020-2234](https://insights.sbomify.com/CVE-2020-2234/): Missing permission check in Jenkins Pipeline Maven Integration Plugin allow capturing credentials (medium 6.5) - [CVE-2020-22336](https://insights.sbomify.com/CVE-2020-22336/): Memory corruption in pdfcrack project:pdfcrack (critical 9.8) - [CVE-2020-22334](https://insights.sbomify.com/CVE-2020-22334/): Cross-site request forgery in beescms:beescms (medium 6.5) - [CVE-2020-22330](https://insights.sbomify.com/CVE-2020-22330/): Subrion Cross-Site Scripting (XSS) vulnerability (medium 6.1) - [CVE-2020-2233](https://insights.sbomify.com/CVE-2020-2233/): Missing permission check in Jenkins Pipeline Maven Integration Plugin allows enumerating credentials IDs (medium 6.5) - [CVE-2020-22327](https://insights.sbomify.com/CVE-2020-22327/): Cross-site scripting in hfish project:hfish (medium 6.1) - [CVE-2020-2232](https://insights.sbomify.com/CVE-2020-2232/): Jenkins Email Extension Plugin SMTP password transmitted and displayed in plain text (high 7.5) - [CVE-2020-22312](https://insights.sbomify.com/CVE-2020-22312/): Cross-site scripting in hznuoj project:hznuoj (medium 6.1) - [CVE-2020-2231](https://insights.sbomify.com/CVE-2020-2231/): Improper Neutralization of Input During Web Page Generation in Jenkins (medium 5.4) - [CVE-2020-2230](https://insights.sbomify.com/CVE-2020-2230/): Jenkins Cross-site Scripting vulnerability in project naming strategy (medium 5.4) - [CVE-2020-2229](https://insights.sbomify.com/CVE-2020-2229/): Jenkins Cross-Site Scripting vulnerability in help icons (medium 5.4) - [CVE-2020-22284](https://insights.sbomify.com/CVE-2020-22284/): Memory corruption in lwip project:lwip (high 7.5) - [CVE-2020-22283](https://insights.sbomify.com/CVE-2020-22283/): Memory corruption in lwip project:lwip (high 7.5) - [CVE-2020-2228](https://insights.sbomify.com/CVE-2020-2228/): Improper authorization of users and groups with the same base name in Jenkins GitLab Authentication Plugin (high 8.8) - [CVE-2020-22278](https://insights.sbomify.com/CVE-2020-22278/): Code injection in phpmyadmin:phpmyadmin (high 8.8) - [CVE-2020-22277](https://insights.sbomify.com/CVE-2020-22277/): Code injection in codection:import and export users and customers (high 8.0) - [CVE-2020-22276](https://insights.sbomify.com/CVE-2020-22276/): Code injection in weformspro:weforms (critical 9.8) - [CVE-2020-22275](https://insights.sbomify.com/CVE-2020-22275/): Code injection in easyregistrationforms:easy registration forms (high 8.8) - [CVE-2020-22274](https://insights.sbomify.com/CVE-2020-22274/): Code injection in jomsocial:jomsocial (critical 9.8) - [CVE-2020-22273](https://insights.sbomify.com/CVE-2020-22273/): Cross-site request forgery in creativeitem:neoflex video subscription system (medium 6.5) - [CVE-2020-2227](https://insights.sbomify.com/CVE-2020-2227/): Stored XSS vulnerability in Jenkins Deployer Framework Plugin (medium 5.4) - [CVE-2020-2226](https://insights.sbomify.com/CVE-2020-2226/): Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin (medium 5.4) - [CVE-2020-22253](https://insights.sbomify.com/CVE-2020-22253/): Misconfiguration in xiongmaitech:ahb7008t-mh-v2 firmware (critical 9.8) - [CVE-2020-22251](https://insights.sbomify.com/CVE-2020-22251/): Cross-site scripting in phplist:phplist (medium 4.8) - [CVE-2020-2225](https://insights.sbomify.com/CVE-2020-2225/): Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin (medium 5.4) - [CVE-2020-22249](https://insights.sbomify.com/CVE-2020-22249/): File upload in phplist:phplist (critical 9.8) - [CVE-2020-2224](https://insights.sbomify.com/CVE-2020-2224/): Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin (medium 5.4) - [CVE-2020-2223](https://insights.sbomify.com/CVE-2020-2223/): Stored XSS vulnerability in Jenkins console links (medium 5.4) - [CVE-2020-22226](https://insights.sbomify.com/CVE-2020-22226/): SQL injection in phpjabbers:fundraising script (critical 9.8) - [CVE-2020-22225](https://insights.sbomify.com/CVE-2020-22225/): SQL injection in phpjabbers:fundraising script (critical 9.8) - [CVE-2020-22224](https://insights.sbomify.com/CVE-2020-22224/): Cross-site scripting in phpjabbers:fundraising script (medium 6.1) - [CVE-2020-22223](https://insights.sbomify.com/CVE-2020-22223/): SQL injection in phpjabbers:fundraising script (critical 9.8) - [CVE-2020-22222](https://insights.sbomify.com/CVE-2020-22222/): Cross-site scripting in phpjabbers:fundraising script (medium 6.1) - [CVE-2020-2222](https://insights.sbomify.com/CVE-2020-2222/): Stored XSS vulnerability in Jenkins 'keep forever' badge icon (medium 5.4) - [CVE-2020-22219](https://insights.sbomify.com/CVE-2020-22219/): Memory corruption in flac project:flac (high 7.8) - [CVE-2020-22218](https://insights.sbomify.com/CVE-2020-22218/): Memory corruption in libssh2:libssh2 (high 7.5) - [CVE-2020-22217](https://insights.sbomify.com/CVE-2020-22217/): Memory corruption in c-ares:c-ares (medium 5.9) - [CVE-2020-22212](https://insights.sbomify.com/CVE-2020-22212/): SQL injection in 74cms:74cms (critical 9.8) - [CVE-2020-22211](https://insights.sbomify.com/CVE-2020-22211/): SQL injection in 74cms:74cms (critical 9.8) - [CVE-2020-22210](https://insights.sbomify.com/CVE-2020-22210/): SQL injection in 74cms:74cms (critical 9.8) - [CVE-2020-2221](https://insights.sbomify.com/CVE-2020-2221/): Stored XSS vulnerability in Jenkins upstream cause (medium 5.4) - [CVE-2020-22209](https://insights.sbomify.com/CVE-2020-22209/): SQL injection in 74cms:74cms (critical 9.8) - [CVE-2020-22208](https://insights.sbomify.com/CVE-2020-22208/): SQL injection in 74cms:74cms (critical 9.8) - [CVE-2020-22206](https://insights.sbomify.com/CVE-2020-22206/): SQL injection in shopex:ecshop (critical 9.8) - [CVE-2020-22205](https://insights.sbomify.com/CVE-2020-22205/): SQL injection in shopex:ecshop (critical 9.8) - [CVE-2020-22204](https://insights.sbomify.com/CVE-2020-22204/): SQL injection in shopex:ecshop (critical 9.8) - [CVE-2020-22203](https://insights.sbomify.com/CVE-2020-22203/): SQL injection in phpcms:phpcms (critical 9.8) --- From sbomify Insights: https://insights.sbomify.com/years/2020/page/129/